Free tools Windows power users keep installed
One-click scans. No signup required.
The safest small-business plan combines offline, encrypted backups with a tested recovery procedure. Inventory the systems that keep the business operating, make multiple copies under separate access controls, disconnect at least one copy between backup sessions, and rehearse restoring files and complete systems. If ransomware strikes, isolate affected devices first, then recover in business-priority order from clean backups. Treat possible data theft as a separate incident because restoring files does not undo an attacker’s exfiltration.
What a ransomware-ready backup plan must do
Ransomware can encrypt production files, mapped network shares, databases and, in some cases, backup repositories that are reachable with the same credentials. A backup strategy therefore has to protect both the data and the ability to reach a clean copy. CISA’s joint #StopRansomware Guide (September 2023, produced with the FBI, NSA and MS-ISAC) states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”
As an Amazon Associate I earn from qualifying purchases.
- Offline protection: Keep at least one current copy disconnected from networks and accounts when it is not being updated.
- Encryption: Encrypt backup data at rest and protect encryption keys separately from ordinary administrator credentials.
- Separation: Use different accounts, permissions or physical locations so one compromised account cannot delete every copy.
- Useful restore points: Retain versions old enough to predate the attacker’s entry and recent enough to limit lost work.
- Proven recovery: Perform restores on clean equipment and verify that files open, applications work and staff can resume operations.
No backup guarantees recovery. The objective is to make a clean, documented restore more reliable and less disruptive than improvising after an attack.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start with an inventory and recovery priorities
Before selecting hardware or a service, list every place business information exists. Include employee laptops and phones, desktop computers, servers, virtual machines, point-of-sale systems, accounting software, customer and order databases, shared drives, email, cloud applications, website content, source code, configuration files and paper records that have been digitized. Record the owner, location, data type, backup method and last successful backup for each item.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Identify the services that keep the business open
Ask which systems are required to take orders, serve customers, pay employees, ship products, communicate with suppliers and meet tax, contractual or regulatory obligations. Rank them rather than labeling everything “critical.” A customer database, for example, may be urgent, while an archive of old marketing material can wait.
Map dependencies before an incident
A recovered file is not useful if the software that reads it, the license that activates that software, the credentials that access it or the configuration that connects it is missing. For every priority service, document its dependent databases, operating-system version, application version, network location, service accounts, recovery keys and required integrations. Keep system images or a repeatable build procedure for critical servers and workstations.
Protect the documentation
Store an offline copy of the asset list, network diagram, recovery order, vendor contacts, license details and emergency procedures. Do not rely on a document stored only in the same cloud account or file server that ransomware could lock. Keep printed emergency contacts where appropriate, but do not print secrets such as passwords or encryption keys.
Build a backup architecture ransomware cannot easily reach
Use multiple copies with different failure modes
Combine a fast, routinely accessible backup with a separately controlled or offline copy. A removable encrypted drive can provide a practical physical copy for a small office, but it is not offline while connected to a computer. Disconnect and secure it as soon as the backup job finishes. Rotate more than one drive if possible so a single failed, lost or recently infected drive does not become the only fallback.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
A network-attached storage device can centralize backups for several computers and speed up local restores. It is not automatically an offline backup: if ransomware or a stolen administrator session can reach the device, its files may also be encrypted or deleted. Restrict administrative access, disable unnecessary internet exposure, enable version history and deletion protection, and maintain a separate copy that the NAS cannot alter.
Cloud repositories can provide geographic separation and scalable retention. Configure multifactor authentication, least-privilege accounts, versioning and protected deletion. Separate backup administration from ordinary email or productivity accounts, and consider a second cloud or offline destination so compromise of one provider account does not remove every restore point.
Consider immutable storage carefully
Immutability can prevent changes or deletion during a defined retention period, which helps against ransomware and malicious administrators. It also requires careful policy and capacity planning. Misconfiguration can create significant storage costs, and an immutable design may not satisfy every legal or industry requirement. Confirm retention, deletion, encryption and audit behavior against your obligations before relying on it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not treat a slogan as a complete policy
The often-mentioned “3-2-1” pattern is associated with Australian Cyber Security Centre guidance, not a universal CISA requirement. Whatever formula you use, specify the number of copies, media types, locations, offline interval, retention period, responsible person and restore test. The meaningful controls are separation, recoverability and regular verification.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Choose backup frequency and retention from acceptable loss
Set the schedule by asking how much recent work the business can recreate. If losing a full day of orders would be unacceptable, a daily job is insufficient; if an archive changes monthly, hourly copies may add cost without useful protection. CISA recommends frequent backups and regular restoration testing but does not prescribe one schedule for every organization.
- Recovery point objective (RPO): the maximum amount of recent data the business can afford to lose. Use it to set backup frequency.
- Recovery time objective (RTO): how quickly each service must return. Use it to decide whether you need local images, spare hardware or a slower cloud restore.
- Retention: keep enough historical versions to cover delayed discovery. Preserve daily, weekly and monthly points when the business can support the storage and management effort.
Retention should include versions from before an attacker entered the environment. If every retained copy is created after silent encryption began, the system may faithfully preserve damaged data.
Compare practical backup approaches
| Approach | Strengths | Ransomware controls required | Restore considerations |
|---|---|---|---|
| Rotated removable drives | Simple physical separation; useful for small data sets and local restores | Hardware encryption, separate storage, offline disconnection, multiple rotated drives and restricted keys | Fast when the drive is available; requires manual handling and compatible replacement hardware |
| Local NAS or backup server | Centralized backups for many computers; convenient versioned restores | Network segmentation, separate administrator accounts, multifactor authentication, snapshots or versioning, protected deletion and an additional offline or separately controlled copy | Usually fast on the local network; unavailable if the site is damaged or the NAS is infected |
| Cloud backup repository | Off-site storage, geographic resilience and scalable retention | Multifactor authentication, least privilege, independent backup administration, versioning, deletion protection and monitoring for unusual activity | Depends on internet bandwidth, provider recovery features and account availability |
| System images plus file backup | Can restore an entire operating environment as well as individual files | Offline or separately controlled image copies, documented hardware and software requirements, and tested boot media | Images shorten rebuilds; file-level copies provide more granular recovery and may be needed for recent changes |
| Managed backup service | Outsourced monitoring, retention management and restore assistance for firms without IT staff | Verify isolation, encryption, subcontractors, account ownership, notification procedures and how the provider prevents one compromised credential from deleting all copies | Clarify support hours, recovery locations, expected transfer times and who performs the actual restore |
Evaluate every option for offline or separate control, deletion resistance, encryption, restore speed, recovery-point age, version history, application coverage, operating cost, maintenance effort and compatibility with contractual or regulatory requirements. A hybrid design is often more practical than choosing one technology for every workload.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallImplement the plan step by step
- Assign ownership. Name a primary backup owner and a deputy. Define who approves retention changes, receives failure alerts and can authorize emergency restores.
- Document the inventory. Record devices, cloud tenants, applications, data owners, dependencies, RPOs, RTOs and recovery priorities.
- Configure protected identities. Use dedicated backup administration accounts, multifactor authentication and least privilege. Keep recovery credentials and encryption keys in a protected mechanism that is available during an outage but not exposed to daily users.
- Create the first full copy. Back up critical files, databases, configurations and system images. Confirm that the job reports success rather than merely starting.
- Add separation. Replicate or copy the data to a different medium or location. Disconnect a removable destination between jobs; for online destinations, enable versioning, protected deletion and independent access controls.
- Set schedules and retention. Match frequency to the documented RPO and keep historical versions that can predate a compromise.
- Alert on failure and tampering. Send backup status to an account or device that ransomware cannot easily alter. Investigate missed jobs, sudden data-volume changes, disabled agents and deletion attempts.
- Record the recovery procedure. Write the exact sequence for obtaining keys, preparing clean hardware, reinstalling applications, restoring data, validating records and reconnecting services.
Test restores, not just backup jobs
A green backup status proves that a job ran; it does not prove that the copy is complete, readable or usable. Schedule representative tests and record the results.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Restore individual documents and confirm that they open without corruption.
- Restore a database to an isolated test system and verify records, permissions and application connectivity.
- Boot a system image on replacement or test hardware and measure the time to a usable desktop or server.
- Practice retrieving encryption keys, licenses, installers and configuration information without relying on the compromised production environment.
- Confirm that the restored system can perform a real business task, such as creating an order, issuing an invoice or sending a customer message.
- Document missing files, unexpected dependencies, elapsed time and who performed each step; update the plan after every exercise.
Test after major application upgrades, changes to cloud accounts, staff turnover or backup-policy changes, not only on a fixed calendar.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when ransomware is discovered
Use an existing incident-response plan if you have one. The order below follows CISA’s containment and recovery priorities; adapt it to safety, legal and operational needs.
- Recognize and report. Record the time, visible symptoms, ransom note, affected users and systems. Alert the person responsible for incident response and avoid deleting evidence.
- Isolate affected systems. Disconnect compromised computers from wired and wireless networks. Separate infected servers, shared storage and remote-access sessions. Do not keep reconnecting devices to “see whether they work.”
- Protect clean recovery resources. Stop automated jobs that could copy encrypted files into clean repositories. Disconnect offline drives and secure unaffected backup media. Use a clean administrative workstation for investigation and recovery.
- Contain credentials and access. From a clean device, disable or rotate compromised accounts, revoke suspicious sessions and review remote-access paths. Preserve logs and evidence before making changes that would destroy them.
- Determine scope. Identify encrypted systems, the likely initial access point, backups touched by the attacker and any signs of data exfiltration. Involve qualified incident responders when the scope is uncertain or the business lacks expertise.
- Prepare a clean environment. Rebuild or replace compromised systems rather than restoring onto machines that may still contain malware. Patch operating systems and applications, remove unauthorized persistence and secure new administrative credentials.
- Restore by business priority. Recover the services needed to operate first, using offline and encrypted backups whose integrity has been checked. Restore dependencies in the order documented during planning.
- Validate before reconnecting. Scan and test restored systems, confirm applications and permissions, and monitor for suspicious activity. Reconnect in stages so a missed infection does not spread through the entire environment.
- Document and improve. Record decisions, downtime, restore points used and control failures. Update the inventory, access controls, backup design and training after the incident.
Recovery does not settle possible data theft
Modern ransomware incidents may combine encryption with exfiltration and threats to publish stolen information. A successful file restore therefore does not establish that customer, employee, financial or confidential data remained private. Preserve evidence, involve legal counsel and appropriate privacy or regulatory specialists, assess contractual notification duties and prepare truthful communications. Do not assume that paying a demand will delete copied data or prevent disclosure.
Common mistakes and fixes
| Mistake | Why it fails | Fix |
|---|---|---|
| Leaving an external drive attached | Ransomware can encrypt or erase the drive through the connected computer | Disconnect it after each job; rotate encrypted drives and store them securely |
| Backing up only to a reachable shared folder | Compromised credentials can alter every copy | Use separate accounts, protected versions and an offline or separately controlled destination |
| Checking only job-success notifications | Unreadable files, missing permissions or absent application data may go unnoticed | Perform file, database and full-system restore exercises |
| Keeping one recent version | Undetected encryption or corruption can be replicated into the only restore point | Retain historical versions and test points from different dates |
| Restoring onto infected systems | Malware can reinfect restored data and clean machines | Rebuild clean environments, validate them and reconnect in stages |
| Ignoring cloud-account compromise | An attacker with administrative access may delete online backups without touching office hardware | Use multifactor authentication, independent administration, deletion protection and activity monitoring |
| Assuming restored files mean the incident is over | Data may have been copied before encryption | Run a separate exposure investigation and handle notification decisions |
When to use outside help
A managed service provider or qualified incident-response firm can help a business without dedicated IT staff design coverage, configure retention, monitor failures and conduct restore exercises. Select a provider only after confirming who owns the accounts and keys, how backups are isolated, where data is stored, how quickly recovery assistance is available and what happens if the provider account itself is compromised. Keep an offline export of essential recovery information even when operations are outsourced.
The most resilient small-business plan is specific: it names the data that matters, keeps a clean copy out of ransomware’s reach, proves that the copy can be restored and gives staff a practiced order of operations. Build and test that plan before an incident, then improve it whenever the business, its systems or its obligations change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
